joleuger/vuinputd
1
0
Fork 0
mirror of https://github.com/joleuger/vuinputd.git synced 2026-11-05 01:17:20 +00:00
Code Issues 7 Projects Packages Wiki Activity

[GH-ISSUE #3] [FEATURE] Implement Fallbackdm for Seat Isolation for Virtual Input Devices #2

New issue
Closed
opened 2026-10-30 21:32:18 +00:00 by bsakaguchi · 1 comment
bsakaguchi commented 2026-10-30 21:32:18 +00:00
Owner
Copy link

Originally created by @joleuger on GitHub (Jan 1, 2026).
Original GitHub issue: https://github.com/joleuger/vuinputd/issues/3

Context & Motivation*
A "sandbox escape" vulnerability exists where a sandboxed application (e.g., a Flatpak) that has permission to access a virtual input device can inject keystrokes into the host's desktop environment.

If a virtual keyboard created by the sandbox is attached to the default seat (seat0), the host's Compositor (Mutter, KWin, etc.) treats it as a physical keyboard. The sandboxed app can then:

  1. Inject Alt+F2 to open the "Run Command" dialog.
  2. Type a command to execute arbitrary code outside the sandbox.
  3. Inject global shortcuts (e.g., Super, Ctrl+Alt+T) to interact with the host shell.

To mitigate this, virtual input devices managed by vuinputd must be logically isolated from the active user session so that the desktop environment ignores their input.

Technical Architecture
This mechanism relies on udev tagging and systemd-logind seat management, supported by fallbackdm to ensure no "unowned" seats exist.

  1. Udev Rule Generation: (already done)
  • Create a udev rule targeting devices created by vuinputd.
  • Match devices by subsystem (input) and specific attributes (e.g., ATTRS{name}=="vuinputd-keyboard").
  1. Seat Assignment: (already done)
  • Apply the tag ENV{ID_SEAT}="seat_vuinput" to these devices.
  • This forces systemd-logind to recognize the device as belonging to a separate seat, distinct from seat0.
  1. Fallbackdm Integration:
  • Ensure fallbackdm is running to own the VTs in case no other graphical interface that owns the VT is running. This prevents the isolated seat from accidentally becoming the "active" console input source if the main graphical session terminates.
Originally created by @joleuger on GitHub (Jan 1, 2026). Original GitHub issue: https://github.com/joleuger/vuinputd/issues/3 *Context & Motivation** A "sandbox escape" vulnerability exists where a sandboxed application (e.g., a Flatpak) that has permission to access a virtual input device can inject keystrokes into the host's desktop environment. If a virtual keyboard created by the sandbox is attached to the default seat (`seat0`), the host's Compositor (Mutter, KWin, etc.) treats it as a physical keyboard. The sandboxed app can then: 1. Inject `Alt+F2` to open the "Run Command" dialog. 2. Type a command to execute arbitrary code outside the sandbox. 3. Inject global shortcuts (e.g., `Super`, `Ctrl+Alt+T`) to interact with the host shell. To mitigate this, virtual input devices managed by `vuinputd` must be logically isolated from the active user session so that the desktop environment ignores their input. **Technical Architecture** This mechanism relies on `udev` tagging and `systemd-logind` seat management, supported by `fallbackdm` to ensure no "unowned" seats exist. 1. **Udev Rule Generation:** (already done) * Create a udev rule targeting devices created by `vuinputd`. * Match devices by subsystem (`input`) and specific attributes (e.g., `ATTRS{name}=="vuinputd-keyboard"`). 2. **Seat Assignment:** (already done) * Apply the tag `ENV{ID_SEAT}="seat_vuinput"` to these devices. * This forces `systemd-logind` to recognize the device as belonging to a separate seat, distinct from `seat0`. 3. **Fallbackdm Integration:** * Ensure `fallbackdm` is running to own the VTs in case no other graphical interface that owns the VT is running. This prevents the isolated seat from accidentally becoming the "active" console input source if the main graphical session terminates.
bsakaguchi commented 2026-10-30 21:32:20 +00:00
Author
Owner
Copy link

@joleuger commented on GitHub (Feb 19, 2026):

https://github.com/joleuger/fallbackdm

<!-- gh-comment-id:3927121632 --> @joleuger commented on GitHub (Feb 19, 2026): https://github.com/joleuger/fallbackdm
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
0.3.2
0.3.1
0.3.0
0.2.0
0.1.0
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
joleuger/vuinputd#2
No description provided.